9257 matches found
CVE-2021-29566 Heap OOB access in `Dilation2DBackpropInput`
TensorFlow is an end-to-end open source platform for machine learning. An attacker can write outside the bounds of heap allocated arrays by passing invalid arguments to tf.rawops.Dilation2DBackpropInput. This is because the...
CVE-2021-29566
TensorFlow: CVE-2021-29566 is a heap-out-of-bounds (OOB) access in tf.raw_ops.Dilation2DBackpropInput due to missing input validation. This can cause writes outside the heap during backprop, as per the OSV/GHSA entries. The issue is fixed in TensorFlow 2.5.0 with cherry-picks to 2.4.2, 2.3.3, 2.2...
CVE-2021-29567 Lack of validation in `SparseDenseCwiseMul`
TensorFlow is an end-to-end open source platform for machine learning. Due to lack of validation in tf.rawops.SparseDenseCwiseMul, an attacker can trigger denial of service via CHECK-fails or accesses to outside the bounds of heap allocated data. Since the...
CVE-2021-29567
TensorFlow vulnerability CVE-2021-29567: SparseDenseCwiseMul lacks validation between input dimensions, only validating input ranks. This enables local attackers to trigger CHECK failures or heap-out-of-bounds writes, causing denial of service. Affected TF versions include 2.5.0 and older release...
CVE-2021-29568
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger undefined behavior by binding to null pointer in tf.rawops.ParameterizedTruncatedNormal. This is because the...
CVE-2021-29568
TensorFlow vulnerability CVE-2021-29568 arises from binding to a NULL pointer in tf.raw_ops.ParameterizedTruncatedNormal due to not validating the shape argument before accessing shape_tensor.flat(0). The issue can cause undefined behavior; the affected commits patch the input validation. A fix w...
CVE-2021-29568 Reference binding to null in `ParameterizedTruncatedNormal`
TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger undefined behavior by binding to null pointer in tf.rawops.ParameterizedTruncatedNormal. This is because the...
CVE-2021-29569 Heap out of bounds read in `RequantizationRange`
TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGradWithArgmax can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The...
CVE-2021-29569
CVE-2021-29569: TensorFlow MaxPoolGradWithArgmax reads past heap bounds when input_min/input_max are empty. The issue stems from accessing first elements of flat() on empty tensors. Patches fix in TensorFlow 2.5.0 and will be cherry-picked to 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Affected ranges are th...
CVE-2021-29569
TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGradWithArgmax can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The...
CVE-2021-29570 Heap out of bounds read in `MaxPoolGradWithArgmax`
TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGradWithArgmax can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The...
CVE-2021-29570
TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGradWithArgmax can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The...
CVE-2021-29570
CVE-2021-29570 affects TensorFlow and specifically the tf.raw_ops.MaxPoolGradWithArgmax path. The vulnerability is a heap out-of-bounds read caused by using the same value to index two different arrays without guaranteed equal sizes, leading to reads beyond heap data when provided crafted inputs....
CVE-2021-29571
TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGradWithArgmax can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The...
CVE-2021-29571
TensorFlow DrawBoundingBoxesV2 memory corruption issue (CVE-2021-29571) arises when the last dimension of boxes is
CVE-2021-29571 Memory corruption in `DrawBoundingBoxesV2`
TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPoolGradWithArgmax can cause reads outside of bounds of heap allocated data if attacker supplies specially crafted inputs. The...
CVE-2021-29572
TensorFlow CVE-2021-29572 is a null pointer dereference in tf.raw_ops.SdcaOptimizer caused by insufficient input validation. Connected sources confirm the issue affects TensorFlow 2.1.4 and other supported releases, with a patch planned in TensorFlow 2.5.0 and back-ported to 2.4.2, 2.3.3, 2.2.3, ...
CVE-2021-29572 Reference binding to nullptr in `SdcaOptimizer`
TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.SdcaOptimizer triggers undefined behavior due to dereferencing a null pointer. The...